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A FRAMEWORK FOR EXACT SYNTHESIS 


VADYM KLIUCHNIKOyi AND JON YARD^ 


Abstract. Exact synthesis is a tool used in algorithms for approximating an 
arbitrary qubit unitary with a sequence of quantum gates from some finite set. 
These approximation algorithms find asymptotically optimal approximations in 
probabilistic polynomial time, in some cases even finding the optimal solution in 
probabilistic polynomial time given access to an oracle for factoring integers. In this 
paper, we present a common mathematical structure underlying all results related 
to the exact synthesis of qubit unitaries known to date, including Clifford+T, 
Clifford-cyclotomic and V-basis gate sets, as well as gates sets induced by the 
braiding of Fibonacci anyons in topological quantum computing. The framework 
presented here also provides a means to answer questions related to the exact 
synthesis of unitaries for wide classes of other gate sets, such as Clifford+T+V and 
SU(2)fc anyons. 


1. Introduction 

The exact synthesis of unitaries is an important tool for compiling quantum algo¬ 
rithms into a sequence of individual quantum gates. Compiling a quantum algorithm 
for a given quantum computer architecture includes expressing or rewriting the al¬ 
gorithm using the elementary operations supported by target quantum computer 
architecture. A typical quantum computer architecture has a fault tolerance layer 
implemented in it. Fault tolerance can be achieved on a logical level, by using 
fault-tolerant protocols based on quantum error correcting codes, on a physical level, 
by computing with topologically-protected degrees of freedom (topological quantum 
computers), or by using some combination of both. The set of elementary opera¬ 
tions supported on a quantum computer typically includes a finite set of single-qubit 
unitaries, a hnite set of two-qubit unitaries, a finite set of single-qubit states that 
can be prepared, and a finite set of measurements that can be performed. We refer 
to the set of single-qubit unitaries as the single-qubit gate set supported by a given 
architecture. Quantum algorithms are usually designed and expressed in terms of 
multi-qubit unitaries that must be expressed using the available one- and two-qubit 
gates. Below, we give a overview of methods for compiling single-qubit unitaries and 
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highlight the role of exact synthesis in this question. For more detailed overview, the 
reader may consnlt e.g. Chapter 2 in [21], 

One of the basic tasks in qnantnm compiling is to implement an arbitrary sin¬ 
gle qubit unitary on the target quantum computer architecture. One of the most 
common types of single qubit unitaries appearing in applications is Rz{4>) = 
where Z is a Pauli Z matrix. However, a computer with finitely-many single-qubit 
operations can never exactly implement every conceivable angle 0. 

For most 0 that appear in applications, the corresponding unitary Rz{4>) can not 
be expressed exactly using the finitely-many available operations. Therefore, one 
must be content to approximate Rz{4>) to within some precision £. There are two 
common approaches to this problem. One approach involves using ancillary qubits, 
special states and measurements [37, 10, 17, 18, 20, 23, 4, 5]. The other approach 
uses only the single-qubit operations available to a given target architecture for ap¬ 
proximating Rz{(j)) [24, 22, 35, 3, 32, 2, 9, 34]. Here, we mainly focus on the second 
class. Frequently, it is possible to extend the original single-qubit gate set available 
on a given architecture using multi-qubit circuits with measurements and classical 
feedback that effectively implements a single-qubit unitary [37, 31, 5, 4, 26]. For 
example, the V-basis unitaries can be implemented using such circuits on any ar¬ 
chitecture that support single-qubit Clifford-I-T unitaries and measurements in the 
computational basis. The Exact synthesis of single-qubit unitaries is an important 
part of recently-developed algorithms for finding approximations to single-qubit uni¬ 
taries using single-qubit unitaries from the Clifford-I-T [35, 32], V-basis [3, 2, 34] 
and Fibonacci anyon gate sets [22]. A distinct feature of these algorithms is that 
they find asymptotically-optimal ^ approximations in probabilistic polynomial time 
[35, 22, 3], or optimal approximations in polynomial time, given access to an oracle 
for factoring integers [32, 2, 34]. All these algorithms exploit the number-theoretic 
structure of the problem. For brevity we will refer to them as Number Theoretic 
Unitary Approximation Algorithms (NTUAAs). Next we briefly outline the high- 
level idea behind NTUAAs and explain the precise role played by exact synthesis in 
their implementations. 

Each NTUAA is designed for a specific target gate set (e.g. single-qubit Clif¬ 
ford-I-T, V-basis, Fibonacci) and for a specific distance measure p defined on single 
quit unitaries (frequently the operator norm). Given a target unitary U', the al¬ 
gorithm outputs a circuit U = UnUn-i ■ ■ - Ui of length n = 0(log(l/e:)) achieving 
dist(t/, U') < e, with each Ui in the target gate set. When we say that such an 
algorithm runs in probabilistic polynomial time or in polynomial time, we mean that 


^By asymptotically optimal, we mean that the length of the circuit found by the algorithm is 
less then C ■ lopt + C', where lopt is the length of the shortest circuit that approximates the target 
unitary with precision e. The constants C, C do not depend on the target unitary or on e. 
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the running time is bounded by a polynomial in log(l/e). The hrst stage of any 
NTUAAs to hnd a unitary U that (a) can be represented exactly using the target 
gate set (b) is within distance e from U' and (c) can be implemented using at most 
0(log(l/e)) gates from the target gate set. The second stage is hnding a circuit over 
the target gate set that implements U. This step is performed by a polynomial-time 
(in the number of bits needed to represent U') exact synthesis algorithm. There are 
two key aspects to exact synthesis: (1) a simple description of all unitaries that can 
be implemented over the target gate set using the number of gates bounded by some 
constant (2) a polynomial-time algorithm for compiling a unitary that is known to 
be representable over the gate set. Previous works gave answers to this question for 
single qubit Clifford-|-T gates, V-basis, Fibonacci gate set and Clifford-1-i?2(7r/n) for 
n = 6, 8,12,16. In this paper we develop a framework for answering questions (1) 
and (2) and several related ones for a wide range of gate sets using the theory of 
maximal orders of central simple algebras and quaternion algebras. Our goal here is 
to set up the foundation for generalizing the ideas behind NTUAAs to a wide range 
of gate sets. The application of our framework to approximating unitaries will be 
treated elsewhere [1]. 

In the next section we briefly review the necessary dehnitions and notation. In 
Section 3 we state the questions relevant to exact synthesis for qubits in the language 
of quaternion algebras. In Section 4 we show how to use tools from Section 3 to 
answer questions related to exact synthesis and discuss how previously known results 
can be derived using the formalism developed in this paper. 

2. Preliminaries and notation 

Fix an integral domain R with fraction held K and let A be a hnite-dimensional K- 
algebra A. An ideal / of A is a torsion-free i?-submodule of A such that I®rK = A, 
i.e. an i?-sublattice of A. An ideal of A that is also a ring (hence an i?-algebra) is 
called an order of A. Equivalently, an order is an ideal in which each element is 
i?-integral, i.e. is a zero of a monic polynomial with coefficients from R. The set of 
orders is partially ordered by inclusion such that every order is contained in some 
maximal order. If A is commutative then contains a unique maximal order, equal 
to the integral closure of R in A. The maximal Z-order in a number held F is its 
ring of integers, denoted Rp throughout. If A is noncommutative, the integral 
closure of i? in A is not generally a ring, but is rather equal to the union of all 
maximal orders in A. Maximal orders may be viewed as integral closures that are 
constrained to be rings. Given an ideal I of A, the sets Oi{I) = {a G A : aJ C /} 
and Or{I) = {a G A : Ja C /} are orders, respectively called the left order and 
the right order of /. When Oi{I) = On and Or{I) = Or, we may also call I a left 
(P^-ideal, a right (P^-ideal or a Oi-Or-ideal, and when Oi = Or = O, we call / a 
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two-sided O-ideal. Then is maximal iff Or is maximal, in which case we follow 
[33] and call I a normal ideal of A. Normal ideals are invertible on the left and on 
the right. A normal ideal I is contained in its left order iff it is contained in its right 
order, in which case we follow [33] and call / an integral ideal of A. Each integral 
ideal J of A is simultaneously a left ideal of Og and a right ideal of Or- An integral 
ideal / is a maximal left ideal of O^ iff it is a maximal right ideal of Or, in which 
case we call / a mciximal ideal (note that [33] calls such ideals “maximal integral 
ideals”). We call a normal ideal I primitive if it is not contained in any proper 
two-sided ideal (equivalently, prime ideal) of Oi (equivalently, of Or). The product 
Ji ■ ■ ■ /„ of ideals of A is proper if Oi{Ij) = Or{Ij+i) for j = 1,... ,n — 1. 

If 7^ is a ring, we write TZ^ for the group of units in TZ. A prime ideal of 7^ is a 
proper two-sided ideal P of 7Z such that IJ G P implies that either I G P or J G P, 
where I G TZ and J G TZ are ideals (equivalently right ideals, or equivalently left 
ideals). Equivalently, a two-sided ideal P G TZ is prime if (a)(6) C P implies that 
either a G P or 6 G P, where (a) := TZaTZ. In a general ring TZ, every maximal ideal 
is prime but we will see that for orders over Dedekind domains, every prime ideal is 
also maximal. 

If P is a Dedekind domain and O is an P-order in a separable P-algebra, then a 
two-sided ideal of O is prime iff it is maximal. This is because maximal two-sided 
ideals are always prime, whereas the reverse direction follows from Theorem 22.3 of 
[33]). In this case, each prime ideal P of O determines a unique prime ideal p of P 
via 

(1) Pi-)-p = PnP. 

If P is a Dedekind domain and AT is a maximal P-order in a central simple K- 
algebra, there is a 1-1 correspondence between prime ideals of P and of AT, with the 
map going the other way given by (Theorem 22.4 of [33]) 

(2) p HA P = AT n rad(ATp), 

where ATp = (P — p)“^AT is the localization of ATp at p and where rad denotes 
the Jacobson radical (intersection of all maximal left ideals); in this case it is the 
unique maximal ideal rad(ATp) = PATp = ATpP. Theorem 22.10 of [33] shows that 
the two-sided AT-ideals form an abelian group whose elements factor uniquely into 
products of prime ideals of AT and their inverses. 

The structure of left ideals (or equivalently, right ideals) of a maximal order AT 
over a Dedekind domain P in a central simple P-algebra is as follows. By Theorem 
22.15 of [33], each maximal left ideal M of AT contains exactly one prime ideal 
P = Annc)(C>/M) = {a: G : xO G M} of AT, corresponding to the prime ideal 
p = Ann/j(0/M) = {a: G P : xO G M}. 
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By a quaternion algebra over a field K, we mean a central simple i^-algebra of 
dimension 4. Any quaternion algebra has an explicit description, in terms of some 
a,b E , as the A'-algebra 

= {xq + Xii + X23 + Xsk : XiE F,i^ = a,f = b,ij = k}. 

We denote the Hamilton quaternions as El = (—^^). The map q ^ q taking 
a quaternion q = qQ + qi\ + q 2 ^ + <? 3 k to its conjugate q = qo — qi^ — q 2 i — <? 3 k is 
A'-linear involution (i.e. an order-2 automorphism such that qr = fq) and can be 
used to express its reduced norm as Nrd(g) = qq = q^ — aqf — bql + abql and 
rednced trace Trd(g) = q + q = 2go- By the norm of an ideal I of Q, we mean the 
fractional ideal of K generated by the reduced norms of the elements of I. By the 
discriminant of an order (9 in a quaternion algebra, we mean the square root of the 
ideal generated by the determinants of all possible 4x4 matrices {TiXiXj)ij where 
Ti, ..., 0:4 G O. The discriminant disc((5) of a quaternion algebra Q is then dehned 
to be the discriminant of any maximal Rp-order in Q (these are sometimes called 
“reduced discriminants” in the literature). It is well-known that the discriminant 
of any quaternion algebra factors into a square-free product of hnitely many prime 
ideals of Rp- A quaternion algebra splits at a place v of K if = Q®kKv — 
and otherwise it is ramified at u. If u is a hnite place, then Q splits at v iff the 
corresponding prime ideal of K divides the discriminant of Q. If u is an inhnite 
place of K, then Q is ramihed at u if Qd — El and it is split at u if Q,; — If 

every real place of K is ramified in Q, then Q is called totally definite and if it is 
not totally dehnite, we call it indefinite. Recall that each number held K satishes 

a: M ~ = M” X c", 

V 

where the product is over the inhnite places u of A', r is the number of real places, 
each corresponding to an embeddings A' M, c is the number of complex places, 
each corresponding to a pair of distinct embeddings K ^ C related by complex 
conjugation, and where [A' : Q] = r -|- 2c. Similarly, 

Q M ~ JJ g, = X (M2x2)n X 

V 

where ro -|- ri = r, so Q is totally dehnite ih it cannot be embedded into 

3. Factorization of quaternions 

Let F be a number held with ring of integers Rp, let g be a quaternion algebra 
over F, let Ad C g be a maximal i?i?-order and let S' be a hnite set of prime ideals 
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of Rp. Let be all elements of M. such that their Nrd factors into elements of S. 
In this section we are discussing the following questions: 

(1) Is there a hnite set Q of quaternions such that any element of can be 
written as gi... for g/c G 

(2) How to hnd Q if (1) is true ? 

(3) Can the set Q in (1) be chosen to be a subset of 

(4) How to hnd ^ C if (3) is true? 

We provide answers to questions (1) and (2) for a wide class of quaternion algebras 
in Section 3.1. In Section 3.2, we describe an algorithm for deciding if (3) is true 
and for constructing Q C M-s- We also discuss how to estimate the size of ^ C M.s 
algorithmically without computing it. The mathematical tools for answering the 
above questions were developed in [33, 19, 36] and many other works. Our main 
contribution is the explanation of how to apply them to the stated questions. 

3.1. Factorization of elements of into a finite set of quaternions. We 

keep the notation described in the beginning of Section 3. The main result of this 
section is the following: 

Theorem 3.1. Any element of AAs can be written as a product gi... g„Ma where 
quaternions gi,..., g„ are from a finite set ext 5 (Al), u G A1 ^ and a G . If one of 
the following conditions holds, then u can he written as the product of a finite number 
elements o/gen^(Al).' 

(1) F is a totally real number field, and Q is a totally definite quaternion algebra. 

(2) F is a totally real number field, and Q is split in exactly one real place. 

There are algorithms for finding exts(Al), gen„(Al) and factorization gi... qnua. 

In other words, when the conditions (1) or (2) mentioned in the theorem above 
hold, any element of Als can be written as a hnite product of elements of ext 5 (Al) U 
gen„(Al). We postpone the proof of the above theorem until the end of this section. 
We will hrst describe set ext 5 (Al) and provide an algorithm for computing it. Next 
we discuss how to compute the set gen„(Al) and hnally provide the algorithm for 
hnding the factorization described in the theorem. The theorem will immediately 
follow from the proof of the correctness of the algorithm. 

Instead of studying the factorization of an element g of Als we will study the 
factorization of the right ideal gAl into maximal right ideals of Al. The following 
result is crucial for this: 

Theorem 3.2 (Special case of Theorem 22.18 in [33]). Let M. be a maximal Rp- 
order in a quaternion algebra Q and let I be a left ideal of Al such that the left 
Ai-module M./I has composition length n. Then I is expressible as a proper product 
h - ■ ■ In of maximal integral ideals such that Oi{I) = Oi{Ii) and Or{I) = 0^{ln). 
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There are multiple ways to determine a factorization of q from the factorization 
of ideals described in the theorem. In this section we describe an approach that 
always works, but does not guarantee that the factors are contained in M-s- Note 
that the factorization of qAi is not sensitive to right multiplication of q by unit u of 
M because quM = qM. For this reason we will need to treat the unit part of the 
factorization separately later in the section. 

For the result of this section it is crucial that there are only hnitely many conjugacy 
classes of maximal orders in any quaternion algebra. It is also important that there 
are hnitely many maximal right ideals with a given norm and a given right order. 
For establishing our results we need to understand how to classify maximal right 
ideals with a given norm and what is the relation between conjugacy classes of their 
left and right orders. 

3.1.1. Classification of maximal right ideals. Now we discuss the classihcation of 
maximal right ideals with a given norm. It is related to the classihcation of primitive 
ideals of maximal orders. 

Definition 3.3. A right ideal of A4 is primitive if it is not contained in any proper 
two-sided ideal of M. 

Note that above dehnition is diherent from one given in [19], this one might gen¬ 
eralize better to general central simple algebras. Equivalently, we can restrict our 
attention above only to J being a prime ideal of M. Our goal is to establish a precise 
relation between maximal ideals and primitive ideals. We hrst recall the results de¬ 
scribing possible values of the norm of maximal right ideals and establishing relations 
between maximal right ideals of A4 and prime ideals of M. 

Theorem 3.4 (Special case of Theorem 22.15 in [33]). Each maximal right ideal 
contains a unique prime ideal P of Ai. 

Theorem 3.5 (Special case of Theorem 24.13 in [33]). Let I be a maximal right ideal 
of Ai. Then Nrd(/) is prime and equal to I H Rp- 

In Theorem 24.13 in [33] it is not stated that I 0 Rp is a prime ideal, however 
this becomes clear after reading the proof of Theorem 24.8. It turns out that the 
converse is also true: 

Proposition 3.6. Let I be a right ideal of Ai. //Nrd(/) is prime, then I is maximal. 

Proof. Let J be a right ideal of Ai containing I and suppose that p := Nrd(/) is 
prime. We will show that either J = I or J = Ai. First note that Nrd(J) | p 
and therefore Nrd(J) is either equal to p or Rp. The equality Nrd(J) = Rp implies 
ord-RpAi/J = Rp which is true if and only if J = A4 (see (24.1) and related 
discussion in [33]). In the case when Nrd(J) = p we have is an integral Ad-ideal 
with Nrd equal to Rp. We conclude that ■J~^I = Ai which implies that I = J. □ 
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Some maximal right ideals are also prime. We can distinguish when it is the case 
based on the norm of the maximal ideal. The following theorem is crucial for this 
purpose: 

Theorem 3.7 (Special case of Theorems 25.7, 25.10 in [33]). Let M. be a maximal 
order in Q. For each prime ideal p of Rp, define its local index m{p) in Ai via the 
equality pA4 = where P is the prime ideal of Ai with norm p. Then m(p) = 1 

for all but finitely many p. The discriminant of Q is equal to Hp ^ where the 
product is over prime ideals p of Rp. 

Using the results above we establish the following relation between maximal and 
primitive ideals: 

Proposition 3.8. Let I be a right ideal of A4 with prime norm p. Then there are 
two alternatives: 

(1) p \ disc(Q) and I is prime 

(2) p \ disc(Q) and I is primitive. 

Proof. Let p = Nrd(/). By Proposition 3.6, the right ideal I is maximal. By 
Theorem 3.4 there exists a prime ideal P of A4 such that Pel. First suppose that 
p divides the discriminant of Q. By Theorem 3.7 we have Nrd(P) = p, therefore 
I~^P is an integral A4-ideal with norm equal to Rp. We conclude that I~^P = Ai. 
and J = P, as required. Consider the case when p does not divide the discriminant 
of Q. We seek a contradiction by assuming that I is not primitive. This implies 
/ = P, but Nrd P = p2 and Nrd(P) ^ Nrd I. □ 

Recall the dehnition of the projective line over a commutative ring P: 

pi(P) = {(x, y)-.xR + yR = R}/R^ 

and let {x : y) = R^ ■ {x,y) denote the line passing through the point {x,y). The 
number of points in P^(P^/o) is equal to 

(3) 4>(a) = nNF/Q(P'P(Nf/Q(p) + l), 

p^la 

where the product is over the highest powers p® of prime ideals dividing a (see Page 
27 in [19]). This will be also very useful for Section 3.2. The following result classihes 
the maximal primitive ideals of Ai via an explicit construction: 

Lemma 3.9 (Special case of Lemma 7.2 from [19]). Let a be an ideal of Rp that is 
co-prime to the discriminant of Q. Then the set of primitive right ideals of Ai with 
norm a is in bijection with ¥^{Rp/a). Explicitly, given a splitting 

(fa ■ Ai ^ Ai Ra — M2{Ra) —t M2{Rp/ a). 
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Input: / - right integral Al-ideal 
1: procedure PRIMITIVE-IDEAL(/) 

2: Factor Nrd(/) into a prodnct of prime ideals of Rp 

3: P {P : P prime ideal of Ai snch that P fl Rp = pfc, A: = 1,..., m} 

4: J' ^ I 

5: for P eV do 

6: while J'd P do 

7: J' E- J'P~^ > J' is always integral Al-ideal, 0^(7') = 

8: end while 

9: end for 

10: return J 

11: end procedure 

Output: J - primitive right Al-ideal snch that / C J and Oi,{I) = Oi{J) 
Figure 1. Algorithm for computing primitive ideal 


where Pa is the corresponding localization of Rp, the bijection is given by 
F\Rp/a) ^{I CM: Nrd(/) = a} 

{x :y)^ = Q^Af + aAf. 

We hnish this part showing a useful relation between integral and primitive ideals: 


Proposition 3.10. Each right ideal I of M is contained in a unigue primitive right 
ideal J of M such that Oi{I) = Oi{J). There exists an algorithm for finding J (see 
Figure 1 ). 


Proof. We first show that the algorithm in Figure 1 outputs an integral Oi{I)-M- 
ideal that contains I. Note that during the execution of the algorithm ideal J' 
always satisfies the mentioned properties. This is the case when J' is initialized with 
I. Before the line 7 in Figure 1 is executed we have J' C P, which implies that 
J'P~^ is an integral ideal. Left and right orders of J'P~^ are the same as right and 
left orders of J' because P~^ is a two-sided ideal of Al. □ 

This result implies that we we can always study the factorization of ideals by 
separately studying factorization of two-sided ideals and factorization of primitive 
ideals into product of maximal primitive ideals. 
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3.1.2. Conjugacy classes of maximal orders. Adjacency structure. The notion of two 
maximal orders being p-neighbors is closely related to the factorization of integral 
ideals into a product of maximal integral ideals. 

Definition 3.11. Maximal orders Ai' and Ai" are called p-neighbors if there exists 
an integral Ai'-Ai"-\dea\. I oi Q such that Nrd(/) = p. For a set S of prime ideals 
of Rp, we say that Ad' and Ad" are S'-neighbors if they are p-neighbors for some 

p G 

Note that the factorization R - ■ ■ R described in Theorem 3.2 determines a se¬ 
quence of maximal orders 

0,(Ji) = ORh), ..., ORin-i) = ORR), ORln) 

along which all adjacent pairs are S'-neighbors, where S is a set of all prime ideals 
dividing the norm of Ji... J„. The maximal orders in any such sequence belong to 
a hnite set of different conjugacy classes (see Problem 2.8 and related discussion in 
[19]). The following structure relates the S-neighbor relation and conjugacy classes 
of maximal orders. 

Definition 3.12. Given ideals pi,..., p/ C S coprime to disc(Q) and representatives 
All,..., Aim for the conjugacy classes of maximal orders of Q, the maximal orders 
adjacency description is a sequence Adji i,..., Adj^ j. Each Adj^j is a sequence 
where Nj = Ni?/Q(pj) -|- 1. Each is a pair (s, g) where s is an 
integer and q is an integral element of Q. Each pair (s, q) corresponds to a maximal 
order gAl^g^h The sequence Adj^^ describes all pj-neighbors of the maximal order 
Al,. 

For our goals it is important that we can compute the maximal orders adjacency 
description for a given quaternion algebra Q and a set S of prime ideals of Rp- The 
algorithms for constructing it using algorithms from [19] as building blocks is shown 
on Figure 2. It uses the following algorithms as subroutines: 

• CONJ-CLASSES-LIST. Returns a list of representatives for the conjugacy 
classes of maximal orders in a quaternion algebra. Equivalent to Ending 
representatives of one-sided ideal classes. See also Problem 2.8 and related 
discussion in [19]. 

• IS-CONJUGATE. Equivalent to testing if a right ideal of quaternion algebra 
is principal. See Problem 2.7 in [19]. 

• ISOMORPHISM-GENERATOR. Equivalent to finding a generator of a prin¬ 
cipal right ideal of a quaternion algebra. See Problem 2.4 in [19]. Through 
the paper without loss of generality we assume this procedure returns integral 
quaternions. 
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• P-NEIGHBORS. Computes the p-neighbors of given maximal order A4. First 
enumerates all right ideals of M with norm p (using Lemma 3.9) and then 
computes their left orders. The details are described in [19]. 

Implementation of all these algorithms (or equivalent) is available in MAGMA. 


Input: Set S of prime ideal of Rp 
1: procedure MAX-ORDERS-ADJ(5) 

2: Let pi,..., pi be all elements of S 

that does not divide the discriminant of Q 
3: Adj <(— empty maximal orders adjacency description 

4: ^ CONJ-CLASSES-LIST 

5: for all i = 1,..., m do 

6: for all j = 1,..., I do 

7: M[, A^)v(pi)+i ^ P-NEIGHBORS(Mi,Pj ) 

8: for all k = 1,..., N{pj) + 1 do 

9: Append CONJ-CLASS-DESCR(Af'J to Adj^^^- 

10: end for 

11: end for 

12: end for 

13: return Adj 

14: end procedure 

Output: Maximal orders adjacency description Adj (see Dehnition 3.12) 

Input: Maximal order of quaternion algebra Ai 
15: procedure CONJ-CLASS-DESCR(Af) 

16: Ml,Mm ^ CONJ-CLASSES-LIST 

17: for all s = 1,..., m do 

18: if IS-CONJUGATE(M,M,) then 

19: q ^ ISOMORPHISM-GENERATOR(Af, Ms) 

20: return (s, q) 

21: end if 

22: end for 

23: end procedure 

Output: (s, q), where s is the index of the maximal order M 
in the sequence Mi,..., Mi output by 
CONJ-CLASSES-LIST, and M = qMsq-^ 

Figure 2. Algorithm for computing the maximal orders adjacency 
description (see Dehnition 3.12) and related sub-routine. 


> See 3.1.2 

> See 3.1.2 

> See 3.1.2 
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We sketch the proof of the correctness of the MAX-ORDERS-ADJ procedure. The 
crucial point here is that when p \ disc((5) and Ad is a maximal order of Q, there 
is a one-to-one correspondence between p-neighbors of Ad and primitive maximal 
right ideals / of Ad with norm p. Any such ideal I corresponds to the p-neighbor 
0^{I) of Ad. Proposition 3.10 shows how to hnd the ideal corresponding to a given 
p-neighbor of Ad. To summarize (keeping the notation from Dehnition 3.12), it is 
sufficient to enumerate all primitive right Adj-ideals with norm p^ to compute Adj^j. 
This is precisely what is done on line 7 in Figure 2. 

3.1.3. Reduction of the factorization question to the description of principal two-sided 
ideals. Now we are going to show that, using the maximal orders adjacency descrip¬ 
tion, we can reduce the factorization of an arbitrary g G Ad^ to the factorization of 
elements such that g^Adg”^ = Ad. Such elements are generators of two-sided 
principal ideals g^Ad. 

We are going to show that any g from Ad 5 can be written as gi... g^g^ for Qr having 
properties mentioned above and with gi,..., g„ belonging to the set ext 5 (Ad). We 
dehne the set keeping the notation used in Dehnition 3.12. Let io,qM be such that 
Ad = qjnto Qm dehne 

(4) ext 5 (Ad) = [qMQQM ■ (^w) e Adj^^^-,* = l,...,m,j = 1,...,/}. 

The set ext;^(Ad) can be easily computed given Adj output by MAX-ORDERS-ADJ 
and using CONJ-CLASS-DESCR from Figure 2 . 

The notion of p-adic valuations Up of number held elements and ideals is crucial 
for counting the number of terms in factorization of g. We also dehne vs = X^pes^P- 
We use it to state the main result of this part: 

Theorem 3.13. Let q be an element of Ads <ind let Si <Z S contain all prime 
ideals of S that are co-prime to the discriminant ofQ. There exists a factorization 
g = gi... qnqrem such that n < U 5 ^(Nrd(g)), gi,..., g„ G ext; 5 (Ad) and qremAd is a 
two-sided ideal. More precisely, n = where I is the unique primitive right 

ideal of At contained in gAd. There exist algorithms for finding the factorization 
qi... qnqrem (EXACT-SYNTHESIS-STAGE-1 on Eigure 3) and for computing the 
set ext 5 (Ad). 

Proof. To prove the theorem we will prove the correctness of EXACT-SYNTHESIS- 
STAGE-1 on Figure 3. We hrst prove that EXACT-SYNTHESIS-STAGE-1 is cor¬ 
rect under the assumption that REDUCED-IDEAL is correct and then show the 
correctness of REDUCED-IDEAL. 

First note that the while loop of the procedure terminates in n steps. This 
is the case because REDUCED-IDEAL reduces U 5 ^(Nrd(/)) by one. Recall that 
Ml,. ..Mm are representatives of the conjugacy classes of maximal orders of Q. 
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Input: Maximal order of Q, set 5* of prime ideals of Rp, 

an element q of Ai snch that Nrd{q)RF factors into ideals from S 
1: procedure EXACT-SYNTHESIS-STAGE-l(AI,5,g) 

2: (so, go) ^ CONJ-CLASS-DESCR(M), s ^ sq 

3: I ^ g(7^PRIMITIVE-IDEAL(gAf)go > 0,(1) = Ms 

4: C ■(— empty sequence of elements of Q 

5: while Or{I) 7 ^ Oi{I) do 

6: (s, /, gj ^ REDUCED-IDEAL(s,/,A) > 0,(/) = Ms 

7: Add qc to the end of C 

8: end while 

9: Let C" = 

10: Let C = gogigo^\ • • •, qoq'n%^ = gi, • • •, gn > Sequence of elements of ext 5 (AI) 

11: Qrem ^ > NoW qrem.Mq~}^ = M 

12: return (G, qr) 

13: end procedure 

Output: Sequence G = gi,..., and quaternion qr such that gi... qnqr = q where 
qi are from ext 5 (AI) and qrM is a two-sided Al-ideal 

Input: Primitive right Al-ideal I such that its Nrd factors into elements of S', 
set S of prime ideals of i?i7’ 

where s is an index of M in the sequence output 
by CONJ-CLASSES-LIST 
14: procedure REDUCED-IDEAL(s,/,A) 

15: Let Si = {pi,..., pi} be all elements of S 

that does not divide the discriminant of Q 
16: for all /c = 1,..., / do 

17: N -(—All right Als-ideals with norm pi > Precomputed for all s, I 

18: for all r E N do 

19: if J C /' then 

20: / ^ 1(1')-^ 

21: (s,ge) ^ CONJ-CLASS-DESCR(0^(/)) 

22: return (s, q~^Iqc, qc) 

23: end if 

24: end for 

25: end for 

26: return (0, /, 0) > We prove that this point is never reached 

27: end procedure 

Output: (s, A, qc), where /' is a right Al-ideal such that s 

is an index of M in the sequence output by CONJ-CLASSES-LIST, 
ideal qcRqc^ is a right ideal that contains J, has the same 
left order as / and vsi(JSYd{Ir)) = vsi(JSTd{I)) — 1 > 0. 

If usj (Nrd(/')) > 0, the ideal /' is primitive, /' is an order otherwise. 


Figure 3. Reduction of factorization of g from Ms fo factorization 
of elements that generate two-sided AJ-ideals 
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Each time before and after the execution of the while loop body the following is 
true: 

Or{I) = Ms, Oi{I) = gM(g')~\ g' = {g'^g'^... g'^Y^g, where C = g[,... ,g'^ 

After the execution of the while loop we have Oi{I) = Or{I), and they must be equal 
to Mso because Oi{I) is conjugate of Mso- We get the following for C = gj,..., g'^\ 

Mso = g'M(g')~\g' = (gogi • • • gn)~^g, M = gog'M(g')~YY 

Next we rewrite gog' as • • • (gogigo^)~^^ see that this element gen¬ 
erates a two-sided Ad-ideal. Also note that all elements ai'e from ext 5 (Ad) 

by construction. From this we conclude that the output of the algorithm is correct 
and is a factorization of g described in the statement of the theorem. 

Let us now show that procedure REDUCED-IDEAL on Figure 3 works as spec- 
ihed. Let / be a primitive Ad^-ideal input to REDUCED-IDEAL. According to 
Theorem 3.2 there exists a factorization of I into a product R ■ ■ ■ /„ of maximal 
ideals. Each of maximal ideals R must be primitive and have norm from Si, because 
the converse would contradict to I being a primitive ideal. Moreover, R must be 
from the set N. Therefore there exist at least one element /' of N such that I <Z I'. 
Note that I G I' implies that there exits an integral ideal J such that I = JI'. 
We see that J = Equality n 5 RNrd(/')) = 1 and multiplicativity of Nrd 

implies that n 5 j(Nrd(J)) = n 5 j(Nrd(/)) — 1. The norm of J factors into elements of 
Si, therefore J can be an order only in the case when n 5 RNrd(J)) = 0. All other 
claimed properties of the output of REDUCED-IDEAL can be easily checked by 
inspection. □ 

Let us now consider the restriction on the Nrd of grem- Condition g^em = (?i • ■ • gn)~^ 
implies that Nrd(grem)-RF factors into ideals from the following set: 

(5) Sext = {p : P divides Nrd(g)i?i?, g G ext 5 (Ad)} U S 

Note that there is some freedom in choosing elements ext 5 (Ad). Recall that any 
element of ext; 5 (AT) has form g^ggY- The quaternion g comes from some pair (s, g) 
of AdJj j (Adj is the adjacency structure of maximal orders). The quaternion go 
is chosen such that goMgY = Mk- Maximal order Mk is an element of the list 
for Ml,... ,Mm of representatives of conjugacy classes of Q hxed throughout this 
section. Note that according to the dehnition of Adj we can replace (s, g) with (s, g') 
if gMsg~^ = g'Msg'~^- In other words, pairs (s, g) and (s, g') are equivalent if g~^g' 
generates a principal two-sided ideal of Ms- 

Using discussed freedom of choosing elements of ext 5 (Ad) one might try to make 
the set Sext as small as possible. Consider hrst the situation when two-sided ideal 
class group is trivial. This means that we can always choose pair (s, g) such that 
ideal gMg is primitive and has norm coprime to the discriminant of Q. Indeed if 
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qM-s is not primitive we can always write it as JJ for J being a two-sided A^^-ideal 
and I being primitive ideal. Under our assumptions, J is a primitive ideal, therefore 
I is also primitive. We then replace (s, q) with (s, q') where q'Ais = I- 

In general, the two-sided ideal class group is a hnite Abelian group. In this case, 
for each pair (s, q) from Adjjj one might compute a primitive Ad^-ideal Iq such that 
qM-s = IqJq and try to optimize over possible choices of two-sided ideals J' with the 
same image in the two-sided class group as Jq and such that the norm of Jq. (a) has 
small number of factors and (b) is co-prime to discriminant of Q. We will see later 
in this section why it is useful to ensure that Nrdg in pairs {s,q) is coprime to the 
the discriminant of Q. 

3.1.4. Factorization of generators of two-sided ideals. In this section we will study 
the factorization of two-sided ideals with norm supported in S. Out goal is to prove 
the following result: 

Proposition 3.14. Let q generate a two-sided ideal of At whose norm is supported 
in S. Then q can be written as qi... qnUa, where gi,..., are from the finite set 
ext|(Al), OL G and u E ■ There exist algorithms for finding the factorization 
and for computing the set ext|(Al). 

Proof. We begin by writing q = q^a, where a G F^ is such that go is an integral 
element of Q with norm supported in S (i.e. an S'-unit). Let pi,..., p; be the elements 
of S coprime to the discriminant of Q and let pz+i,..., pi+n be the ones that divide 
the discriminant of Q. For /c = / -|- 1,..., / n, let be the prime ideals of At such 
that P| = pkAi. We can write the ideal qoAt as 

c(Z) pc(Z+l) pc(Z+n) 

Pi ■■■Pz 0+1 ■■■O+n • 

For /c = 1,...,/, let h{k) be the smallest positive integer such that is principal 
and such that the ideal = q^At is principal. Then we can dehne: 

(6) ext|(Al) ={gzc : A; = / -I- 1,..., / -I- n}U 

[q:qM = pf> .. +f >P,f+‘>... P,f+”>, c(k) < h(k)]. 

It is easy to see that any two-sided integral ideal can be written as a product of 
elements qAt times some element of Rp. If two quaternions generate the same two- 
sided ideal of At they can only differ by unit of At. This concludes the proof. □ 

When the two-sided ideal class group of Q is trivial, the above proposition can be 
simplihed as follows: 

Proposition 3.15. Let Pi,..., P„ be prime ideals with norm dividing the discrimi¬ 
nant of Q and from S. Let gi,..., g„ be generators of Pi,..., Pn. Any element that 
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Input: Maximal order of Q, set S' of prime ideals of -Ri;’, 

an element q oi A4. snch that NTd{q)RF factors into ideals from S 
(assnmes that two side ideal class gronp of Q is trivial) 

1 ; procedure EXACT-SYNTHESIS-2(Al,R,g) 

2 : {C,q) ^ EXACT-SYNTHESIS-STAGE-l(Al,R,g) 

3: Add TWO-SIDED-DECOMPOSE(g,Al,R) to the end of G > Figure 8 

4: return C 

5: end procedure 

Output: Ontpnts qi... qmU\.. .Un = q where 

qi are from ext 5 (AI) and Uj are generators of the nnit gronp of M. 

Figure 4. Algorithm for finding the factorization of elements of AI 5 
described in Theorem 3.1 when the case of trivial two-sided ideal class 
gronp. 

generates a two-sided ideal with norm supported in S can be written as a product 
aqf-^'^... qn^\, where c{k) & 0,1, a E and u E . 

Based on the discnssion in the end of Section 3.1.3 we can also make Sext C S. 
This simplified sitnation will freqnently appear in onr applications. This leads to 
the simple algorithm TWO-SIDED-DECOMPOSE, which decomposes generators of 
two-sided ideals and is shown in Fignre 8 . 

3.1.5. Unit group elements factorization. To the best of onr knowledge the algorith¬ 
mic aspect of this qnestion is well-stndied in two following sitnations: 

( 1 ) E is a totally real nnmber field, and Q is a totally definite qnaternion algebra. 

( 2 ) E is a totally real nnmber field, and Q is split in exactly one real place. 

In both cases there are algorithms for compnting the nnit gronp of a maximal order, 
for hnding its generators and for solving the word problem in terms of generators 
[19, 36]. Implementations of related algorithms are available in MAGMA. In onr 
psendo-code we refer to procednres for decomposing nnits as UNIT-DECOMPOSE. 

3.1.6. Summary. Now we snmmarize results obtained above and prove Theorem 3.1. 
We also combined algorithms discussed above into the algorithm for hnding a fac¬ 
torization. In Figure 4 we show the pseudo-code for the exact synthesis algorithm 
in the case when two-sided ideal class group is trivial. It is not difficult to obtain an 
algorithm for more general cases based on results of this section. 

Proof of Theorem 3.1. To prove the theorem, we combine results of Theorem 3.13 
and Proposition 3.14. For the decomposition of units and hnding the generators of 
the unit group we use results discussed in Section 3.1.5. Recalling the dehnition 
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of Sext (equation (5)) and ext|(A^) (equation (6)) we conclude that ext 5 (A^) = 
ext 5 (A^) U ext|^^^(A^). An algorithm for hnding the factorization is shown on 
Figure 4 in the special case when two-sided ideal class group is one. Algorithms 
for hnding Sext, ext5(A4) and ext|^^^(A4) were discussed above. □ 

3.2. Factorization of elements of Ais into a finite subset of Ais- In this 
subsection we use an approach similar to Section 3.1, but describe another way of 
coming back from the factorization of an ideal qAi into a product of maximal ideals 
Ji ■ ■ ■ In of Q (described in Theorem 3.2) to the factorization of q into a product 
of hnitely many elements of Ais- The basic idea is to group consecutive maximal 
ideals in A ■ ■ ■ /„ into products (/a:(o) ■ ■ ■ -^fc(i)) ''' (-lfc(m-i) ■ ■ ■ A(m)) such that each 
block ■ ■ ■ Ik{j)) is a principal ideal. This approach hnds a factorization of q 

into hnite set of elements oi Ads under some technical assumptions. To formulate 
them we introduce the notion of the ideal principality graph. 

3.2.1. Ideal principality graph. We hrst introduce the dehnitions required to state 
the main result of this subsection. 

Definition 3.16. The ideal principality graph Gs{Ai) is an oriented graph whose 
vertices are maximal orders of the quaternion algebra Q and is dehned by the fol¬ 
lowing rules: 

• Ad is a vertex of Gs{Ai) (called a root of (^^(Al)). 

• Let Ai' be Ad or a vertex of Gs(Ai) that it is not a conjugate of Ad and let 
Ad" be a maximal order such that there primitive integral Ad" — Ad'-ideal I 
with norm from S, then Ad" is a vertex of Gs(Ai) connected to Ad' by arc 
(Ad', Ad"). All such maximal orders Ad" are vertices of Gs(Ai). 

• Vertices of Gs(Ai) that are conjugate of Ad and not equal to Ad are called 
leaves of (^^(Ad). 

Note that Gs(Ai) is connected because by dehnition every vertex of Gs(Ai) is 
connected to Ad, all leaves have outdegree 0, outdegree of all other vertices is the 
same. Leaves of G 5 (Ad) are closely related to all possible principle ideals we can get 
when considering blocks (A(j_i) ■ ■ ■ A(j)) mentioned above. 

Definition 3.17. Let Ad' be a leaf of Gs{Ai) and q(Ai') be an element of Ads such 
that Ad' = qAiq~^, then the set of leaf generators is 

geng(Ad) = {g(Ad') ; Ad' is a leaf of Gs(Ad)}. 

The following theorem is the main result of this section: 

Theorem 3.18. Suppose that: 

(1) graph Gs{AA) is a finite graph, 
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(2) each element of gencan be chosen such that its Nrd factors into ele¬ 
ments of S, 

then any element of A4s can he written as a product qi... QnUa, where qi,... ,qn G 
gen 5 (A^) Uext|(A^), u G and a E . 

There are algorithms for checking that (1) and (2) are true, for computing gen 5 (A^)U 
ext|(A^) and for finding a factorization qi.. .qnua when the conditions (1) and (2) 
are true. 

If one of the following conditions holds, the unit u can he written as a product of 
finite number elements o/gen^(A^); 

(1) F is a totally real number field, and Q is a totally definite quaternion algebra. 

(2) F is a totally real number field, and Q is split in exactly one real place. 

There are algorithms for finding gen^^^AA) (see Section 3.1.5) in both cases mentioned 
above. 

For the algorithmic solution to (2) in the theorem above see Remark 3.21. For 
the algorithm for hnding a factorization, see procedure EXACT-SYNTHESIS-1 on 
Figure 8. For the algorithm for deciding if Gs{Ai) is finite graph, see procedure 
SPANNING-TREE-SIZE on Figure 7. For the algorithm that finds gen_ 5 (Ad), see 
procedure FIND-S-GENERATORS on Figure 5. See also equation (6) for the deh- 
nition of ext|(AT) and related discussion about computing it. 

Now we show how to use the ideal principality graph to reduce the problem of 
factoring elements of Ads to factoring elements that generate two-sided ideals of A4. 
We will use the following integral complexity measure to state the result: 

Definition 3.19. The integral complexity measure of a primitive ideal I is defined 
as /is(/) = ns(Nrd(/)). For q being an elements of Ais and Ig being the unique 
primitive Ad-ideal that contains qAi, the /is(q') = /rs(/q). For two maximal orders 
Ad', Ad" we define the distance , -M") to be a complexity measure /xs(/) of 

the unique primitive ideal I that contains ideal Ad'Ad". 

Note that for q corresponding to a leaf of Gs{Ai) its integral complexity measure 
fis{q) is equal to the distance from the leaf to the root of G's(Ad). 

Theorem 3.20. If Gs{Ai) is a finite graph then, for any element q of Ais there 
exist elements qi,... ,qm of geng{Ai), and a quaternion go such that Ad = qaAiq^^, 
g = gi. ..qmqo and /is(g) = YJk=iPis{qk)- 

Proof. By Proposition 3.10 there exists a unique primitive right Ad-ideal I such that 
gAd = JJo, for Jo being a two-sided Ad-ideal. By Theorem 3.2, the ideal / can 
be written as a proper product of maximal ideals Let Ado = Ad and 

define Ad^ = Oi(Ik) for fc = 1,..., n. The maximal orders Aik must be distinct, as 
otherwise the ideal I would be contained in a nontrivial two-sided ideal, contradicting 
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its primitivity. Note that Mn = gMg~^, in other words Mn is isomorphic to A4. Let 
/c(0) = 0 and choose k(l) such is the hrst order in the sequence Mi,... ,Mn 

isomorphic to M. Then choose k{2) such that Mk{ 2 ) is the second order isomorphic to 
M in the sequence, etc. Build the sequence fc(0), A;(l),..., k{m) as above. Note that 
k{m) = n and the length of the sequence is at most two, because Mn is isomorphic 
to M. 

Now we establish a correspondence between sequences of maximal orders 

Mk{i-i),...,Mk{j)d = l,...,m 

and paths in the graph Gs{M) from the root to the one of the leaves. We hrst 
show that the sequence Mq, ... ,Mk{i) corresponds to the path of Gs'(Wl). We use 
induction by the number of maximal orders in the sequence. For the base case, we 
show that {Mo,Mi) is an edge of and Mi is a vertex of Gs{M). It is 

sufficient to show that Nrd(/i) is in S because any maximal ideal is primitive. By 
Theorem 3.5, Nrd(/i) must be a prime ideal of Rp. By multiplicativity of the norm 
of ideals, we have that Nrd(gWl) C Nrd(/) C Nrd(Jfc) for any k, so therefore Nrd(Jfc) 
must be an element of S. If for some k < k{l), maximal order Mk-i is a vertex of 
Gs{M), then Mk is also a vertex of Gs{M) and {Mk-i, Mk) is an arc of Gs{M). 
This is because R is a primitive ideal with norm from S and Mk-i is not a conjugate 
of M (by construction of the sequence Mo, ■ ■ ■, Mk(i))- Finally we note that Mk(i) 
is a leaf of Gs(M), therefore Mk(o) = gi^Mk(i)gi for gi from gen 5 (Wl). Now we 
apply the isomorphism x i—>• g^^xgi to the sequence of orders Mk(i), ■ ■ ■ ,Mk( 2 ) and 
ideals Ik(i)+i, ■ ■ ■, Ik{ 2 ) and get a new sequence of orders and ideals. The argument 
above now applies to the new sequence of orders as it starts with M. We hnd g 2 
such that 

-^fc(o) = g2^gi^Mk(2)gig2- 

We proceed in a similar way and hnd a sequence gi,... ,gm oi elements of gen 5 (Wl). 

Let us now decompose the ideal / into principal ideals generated by gk and two- 
sided Wl-ideals. Consider a family of two-sided ideals Jk such that gkM = I{gk)Jk, 
where I{gk) is the unique primitive ideal containing gkM. We show that 

( m 

JoYlJk^ 

k=l 

where gi - ■ ■ gmM is a product of two-sided principal ideals generated by g^- Consider 
the ideal Ik{i) ■ ■ ■ R. Is is a primitive a ideal contained in giM. It is unique and equal 
to giMJi"^. Now consider gi^Ik( 2 )gi ■ ■ ■ gi^ Ik{i)+igi- If is the unique primitive ideal 
contained in g 2 M, therefore 

g2MJ2^ = g~^h(2)gi ■ ■ ■ gi^h{i)+igi 
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Next we express Ik( 2 ) ■ ■ ■ h{i)+i as {qiq 2 Qi ^)-M.k(i)qiJ 2 Therefore the product 

-ffc(2) ■ ■ ■ h is equal to 

{qiq 2 qi^Mk{i)) (qiJ^^qi^) {qiMk{ 0 )) = {qmqi^Mkii)) {qiMk{o))J 2 ^Ji^. 

Next we note that {qiq 2 qi^-M.k{i)) (qiMk(o)) = qiq 2 Mk(o)- Using the same argument 
repeatedly we get equality (7). Multiplicativity of the norm of ideals implies that 
l^s(q) = J2r=i l^s(qk)- We set qo = qq^^ ■ ■ -q^ and note that go generates two-sided 
Wl-ideal Jq ^k^ which is equivalent to q^M-q^^ = M.. 

□ 

Remark 3.21. There is some freedom in choosing elements of gen5(Al). Also, the 
dehnition of gen5(AT) does not guarantee that elements of gen5(AT) have norm from 
S. We will use ideas similar to ones we used to refine the maximal orders adjacency 
structure. Consider an element q G gen5(AT) and let Iq be the unique primitive ideal 
that contains qAi. We can always write qA4 = IqJq, where Jq is a two-sided ideal 
of AT. If the two-sided ideal class group of Q is trivial, then the ideal Iq is principal 
and we can choose q to be its generator. This will ensure that q has norm from S. 

Let now consider how to choose q in the case when two-sided ideal class group 
is non-trivial. It is a finite Abelian group and therefore isomorphic to the group 
Z/djZ for some positive integers di,..., Let x = (xi,..., xd) be an element 
of ideal class group corresponding to Jq and let q for z = 1 ,..., 151 be elements of 
two-sided ideal class group corresponding to prime two-sided AT-ideals Pi with norm 
in S. We would like to find prime ideal J' = nl=i -Uf* such that the class group 
element corresponding to it is equal to x. To do this it is sufficient to solve the 
following system of congruences 

|S| 

CijUi = Xj(mod dj), j = 1,..., D 

i=l 

for integers a^. If the system is solvable for all q from gen5(AT) we can choose 
all gen5(AT) ho have norm from S. This leads to a straightforward algorithm for 
deciding if all elements of geng(AT) can be chosen to have norm from S. 

Corollary 3.22. Let Gs{Ai) be a finite graph. For any element q 0/AT5 such that 
pi{q) > 0 there always exists qi from gen_5(AT) such that tis{qi^q) < Rs{q)- 

The Corollary above immediately implies the correctness of procedure EXACT- 
SYNTHESIS-l on Figure 8 for finding a factorization described in Theorem 3.20. 
Procedure EXACT-SYNTHESIS-l is restricted to the case when two-sided ideal 
class group of Q is trivial. It is not difficult to extend it to the general case, but 
would make exposition more tedious. For more details related to this see discussion 
related to TWO-SIDED-DECOMPOSE procedure. 
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3.2.2. How unique is the factorization of elements ofA4s? Spanning trees ofGs{M)- 
The rest of this section is devoted to the theory needed to prove the correctness of 
procedures SPANNING-TREE-SIZE on Figure 7 and FIND-S-GENERATORS on 
Figure 5. Our ultimate goal is to compute the description of Gs{M.) sufficient for 
Ending its leaves. In other words, it is sufficient for us to hnd a subgraph of Gs{M.) 
that contains at least one path connecting the root of Gs(M) and each of the the 
leaves of Gs(M)- Each path connecting the leaf M' of Gs(M) and its root M 
correspond to a factorization of a unique primitive ideal I that contains ideal M'M. 
The number of such paths is equal to the number of different factorizations of I into 
primitive maximal ideals. We will show that we can build a required subgraph of 
Gs{Ai) by restricting the class of factorizations of I. Moreover, we will show that 
this subgraph is a spanning tree of Gs(M)- 

First we show the connection between the notion of S-neighbors and the dis¬ 
tance between orders. We call two maximal orders M' and A4" S'-connected if 
the unique primitive ideal I containing AA'fA" has Nrd that factors into elements of 
S. Equivalently, they are S'-connected if there exists a sequence of maximal orders 
Ai' = M'l, ..., Ai'^ = Ai” such that for each i, Ad' and Ad'+i are S-neighbors. 

Proposition 3.23. Let Ai' be S-connected to Ai and let Ai" be an S-neighbor of 
Ai'. Then either /us(M,Ai") = /iis(Ai,Ai') + 1, or /us(Ai, Ai") = Ms (Ai, Ai') - 1. 

Proof. Let Jq be the primitive ideal contained in the ideal AiAi' and R be the 
primitive ideal contained in Ai'Ai". If IqIi is primitive we get Ms{Ai, Ai") = 
Ps(h) + Ts(h) = Ps(Ai, Ai') + 1. Let us now consider the case when IqIi is not 
primitive and equal to IJ where / is a primitive ideal and J is a two-sided ideal. 
Let P be the Or{Ii) prime ideal that contains /qR. Note that Nrd(R) must divide 
Nrd(P). Suppose Nrd(R) does not divide Nrd(P). Then there is a prime ideal P' of 
Orih) such that RR = P' and RR C P'. This implies that RR C P' fl P = PP'. 
This implies that R C P which is a contradiction to R being primitive ideal. Because 
R is a maximal ideal such that its Nrd divides Nrd(P) we can write P = RR for 
R being an integral ideal. We see that R = /(JP“^)R. Using that R is primitive 
we conclude that two-sided ideal (JP~^) is trivial and R = JR. By Proposition 3.8 
NrdR does not divide the discriminant of the algebra Q and Ms(A) = 1- We conclude 
that Ms(Ai, Ai") = Ms(Ai,Ai')-l. □ 

The following result shows when a primitive ideal has a unique factorization. In 
particular, it implies that if S contains only one prime that is coprime to the dis¬ 
criminant of Q then the graph Gs(Ai) is a tree. 

Proposition 3.24. Suppose that p does not divide the discriminant of Q. Let I be 
a primitive right Ai-ideal with Nrd(J) = p”, then the factorization of I described in 
Theorem 3.2 into a product of maximal ideals is unique. 
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Proof. We will show the result using an induction on n. For n = 1 it is trivial. 
Assume that it is true of k and suppose that there are two factorizations Ik+ih ■ ■ ■ h 
and ■ ■ ■-^1 of -f- First suppose that Ik+i = /[+!• We note that Oii^Ik) = 

and Ik ■ ■ ■ h = I'k ■ ■ ■ I[ as a. unique primitive ideal connecting Oi^Ik) and Ai. 
Factorizations I[ - ■ ■ and Ii - ■ ■ Ik must be the same by induction hypothesis. Let 
us now consider the case Ik+i 7^ I'k+i- ^^0 seeking a contradiction by counting 
the total number of ideals that has factorization length k + 1. Every primitive right 
Ad-ideal with the factorization length k + 1 can be written as J(i)J(k) where J(k) is a 
primitive right Ad-ideal with factorization length k and J(i) is a maximal right ideal 
with norm p. Therefore is an S neighbor of Oi(^J(k))- Each maximal order 

has (iV(p) -|-1) p neighbours according to Lemma 3.9. According to Proposition 3.23 
they can be distance fc -|- 1 or fc — 1 from Ad. In our case there is only one p 
neighbour that is distance k — 1 from Ad. If we had more than one we would get two 
different factorizations of length k of the same ideal, which contradicts induction 
hypothesis. We conclude that each maximal order distance k from Ad with Nrd 
p^ must have A^(p) p neighbours of distance k + 1 from Ad. Therefore there is at 
most A^(p^)(A^(p) -|- 1) such maximal orders. On the other hand by equation (3) we 
know that there is precisely that many of them. This implies that Ik+i 7^ I'k+i is 
not possible, because the inequality would imply that 0(^{I) is a p neighbor of two 
different maximal orders Or{Ik+i) and Or{lk+^- D 

Out next goal is to show that ordering ideals in the factorization by their norms 
makes the factorization unique. Next we note that we can reorder maximal ideals in 
the factorization, such that their norms are in any preassigned order. This follows 
from the following: 

Theorem 3.25 (Special case of Theorem 22.28 in [33]). Let I be a left ideal of Ai 
and let {S'!,..., S'„} be the composition factors of the Ai-module Ad/J arranged in 
any preassigned order. Then there is a factorization of I as described in Theorem 3.2 
such that the factor modules 

0,(/i)//i, /1//1/2, . . . , /l ■ ■ ■ In-l/h ■■■In 

are precisely Si,..., Sn in that order. 

Note that according to the proof of Theorem 22.24 of [33], the composition factors 
Sk uniquely dehne prime ideals Pk contained in maximal ideals Ik- The immediate 
corollary of the theorem above is: 

Corollary 3.26. Let I be a right ideal of Ai and let pi,... ,p„ be any seguence of 
prime ideals of Rp (not necessarily distinct) such thatlSid^I) = nfc=iPfc- Fhen there 
exists a factorization R - ■ ■ R of I into maximal ideals of Q such that Nrd(JA;) = pfc. 

We use the corollary above to dehne class of factorizations that is unique. 
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Proposition 3.27. Let pi,... ,p; be distinct prime ideals of Rp coprime to the dis¬ 
criminant of Q and let I be a primitive right ideal of A4 with Nrd(J) = pi*'^^... pf^^^ 
Then I factors uniquely into a proper product 

( 8 ) / = /i,i ■ ■ ■ Ii,k(i)l2p ■ h,k{2) ■ ■ ■ h,k{L ■ ■ ■ 

of maximal ideals such that NrdJij = p*. 

Proof. The existence of the factorization follows from Corollary 3.26. The total num¬ 
ber of products of the form (8) that correspond to a primitive ideal is at most 

7V(pi)^W-i(iV(pi) + 1) ■ • • + 1). 

On the other hand, by equation (3), there are precisely that many distinct primitive 
two-sided ideals with norm pi^^^ ■ ■ We conclude that no two products of the 

form (8) can be equal and therefore the factorization of any integral ideal of the form 
(8) is unique. □ 

The proposition above allows us to dehne a spanning tree of Gs{M.). We hrst 
note that path connecting root M. and any vertex At' of Gs{M.) corresponds to the 
factorization of the unique primitive ideal containing M'M into primitive maximal 
ideals. We now restrict Gs(M) to a subgraph that contains only path described 
in the proposition above. This subgraph is connected because described type of 
factorization exists and there is a unique path between any vertex and the root. We 
conclude that the subgraph is a tree We call it a spanning tree of Gs(M) and use 
notation Ts{M.) for it. 

It is useful to observe that the product of two primitive ideals is not always primi¬ 
tive. The following proposition shows under which condition it is true. The following 
proposition will be useful for understanding canonical forms of factorizations. It also 
gives an idea why formula (3) has separate factors for different exact prime factors. 

Proposition 3.28. Let I and J be primitive ideals such that Or{I) = Oi{J) and 
Nrd(/) is coprime to Nrd(J), then IJ is a primitive ideal. 

Proof. Suppose that JJ is not primitive. Then there must exist a prime ideal P of 
Or{J) such that IJ G P. Without loss of generality, assume that Nrd(P) divides 
Nrd(/). Let A ... A be a factorization of J into a product of maximal ideals. Let P' 
be the prime ideal of contained in Ji and let .Jl be the integral ideal such that 

JiJf = P'. Note that IJ.JI C P' and JJJf C PJf = Jf(Jf)-^PJf C (J^)-ipjf. We 
conclude that JJJf C P'n(Jf)“^PJf = P'(J{^)“^PJf. The equality P'n( Jf)“^PJf = 
P'(Jf)“^PJf is true because P' and (Jf)“^PJf have different norms and therefore 
different prime ideals. Above implies that IJn... J 2 G (Jf)“^PJf. We proceed in a 
similar way to show that I G P" for some two-sided ideal P". This contradicts to 
the assumption that / is a primitive ideal. □ 
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Proposition above also allows one to find relation between different elements of 
geng(A^). Let us consider an example to illustrate the idea. Let S = {pi,p 2 } where 
both pi and p 2 does not divide the discriminant of the algebra. Suppose also that all 
one sided ideals are principal. Let gi and g 2 be elements of gen 5 (A^) whose norms 
generate ideals pi and p 2 . Consider now primitive ideal gig 2 -M. that factors into 
maximal ideals I 1 I 2 with norm pi and p 2 . However there exist factorization J^/i 
such that Nrd(J 2 ) = p 2 ,Nrd(/[) = pi. Therefore we find that gig 2 = (y' 25 'i'^ some 
unit u and ( 7 i, 5'2 where Nrd^f^ generate ideal with norm p^. This idea also can be 
used to find relations with more then two generators. 

3.2.3. The algorithm for constructing spanning tree ofGs{M.)- Estimating its depth 
and size. As we discussed before, Proposition 3.2.2 implies that any ordering of the 
elements of S coprime to the discriminant of Q defines the spanning tree Ts{M.) of 
Now we discuss the algorithm for building the spanning tree of Gs{M.) and 
finding elements of gen 5 (Ad). We first give a formal definition of the data structure 
we use to store Ts{M.) and then describe its interpretation. 

Definition 3.29. Let the description of Ts{Ai) be a sequence 1^-, j = 0,..., M where 
M is possibly 00. Each I 4 is a finite sequence Vk,i^ ■ ■ ■ ,Vk,M{k)- Each Vkj is a tuple 
(si, S 2 , S 3 , q) such that Si, S 2 , S 3 are integers and q is from Q. Let also 

(1) IDEAL-ID(si,S 2 ,S 3 ,g) = si 

(2) PARENT-ID(si, S 2 , S 3 , O') = S 2 

(3) MAX-ORDER(si,S 2 ,S 3 ,g) = (s 3 ,g) 

(4) V[k] = Vk, V[k,j]=vk,j 

We call V the sequence of levels of Ts(M), Vj a level of Ts(M) and Vij a vertex 
description. Vq consists of the single element ( 1 , 0 , ko, qo). 

By constructing Ts{M.) we mean first deciding if M is finite and then finding the 
description of Ts{Ai) described above. 

To interpret the definition above we fix the ordering of ideals from S coprime to 
discriminant of Q and conjugacy classes of maximal orders of Q. Recall that the 
number of conjugacy classes of maximal orders of Q is always finite. Let pi,..., p/ 
be ideals from S coprime to discriminant of Q. Let A4i,..., Aim be representatives 
of all conjugacy classes of maximal orders of Q. 

The vertex description v defines a vertex of Ts(Ai) which is a maximal order. Let 
MAX-ORDER(u) = (s,q), then the corresponding maximal order is qAisq~^. This 
representation is valid because for any maximal order of Q we can find such pair 
(s,q). In particular, MAX-ORDER(uo,i) = (■So,<?o) where Ai = q^Ais^qf^- For all v 
from 14 it is the case that MAX-ORDER(u) correspond to maximal orders Ai' such 
that P5(A4,A4') = k. 
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The vertex description also contains information about edges of Ts{Ai). For j = 
PARENT-ID(r;) the maximal order Ai' described by Vk-ij is the unique S'-neigbour 
of qA4sq~^ such that jUs(M', M) = k — 1. More precisely, qA4sq~^ is a p-neighbor 
of Ai', where p has index IDEAL-ID(r’) in the sequence pi,...,p;. If the vertex 
description sequence Vi,...,Vn corresponds to a path in Ts{A4), it must be the 
case that IDEAL-ID(ui),..., IDEAL-ID(u„) is a non-decreasing sequence of integers. 
This is because every such path corresponds to a factorization of a primitive ideal 
into a sequence of the form (8). 

The algorithm for building Ts{Ai) relies on the description of the S'-neighbors 
of all conjugacy classes of maximal orders given by the maximal orders adjacency 
structure (see Dehnition 3.12 ). It is a part of the procedure FIND-S-GENERATORS 
on Figure 5. 

We do not provide pseudo-code of some procedures used in pseudo-code as algo¬ 
rithms implementing them are well-known and their implementations are available. 
For example, many of them are part of software package MAGMA. Below is the list 
of this procedures together with references describing corresponding algorithms: 


Remark 3.30. Procedures used in pseudo-code 

• Finding generators of a maximal order (Figure 6, line 12). Implementation 
is available in MAGMA. 

• Testing the membership in a maximal order (Figure 6, line 14). Implemen¬ 
tation is available in MAGMA. 

• Gomputing the discriminant of quaternion algebra (Figure 7, line 2). Imple¬ 
mentation is available in MAGMA. 

• LENGTH. Returns length of the sequence. 

• TOTAL-IDEALS. Number of ideals in the set S that does not divide the 
discriminant. Testing if given ideal divides discriminant of the algebra can 
be preformed using MAGMA. 

• For MAX-ORDER, PARENT-ID, IDEAL-ID see Dehnition 3.29. 

• We compute valuation vs{x) = Xlpes"where Vp is a p-adic valuation 
of the ideal xF of number held F. Algorithms for computing Vp are well- 
known. 

• Gomputing the generators of prime ideals whose norm divides the discrimi¬ 
nant of Q (Figure 8, line 15). The algorithm is well known [19], its imple¬ 
mentation is available in MAGMA. 

• IDEAL-GENERATOR (Figure 8, line 28). Finds a generator of a right prin¬ 
cipal Ad-ideal. The algorithm is well known [19] and is implemented in 
MAGMA. 
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• UNIT-DECOMPOSE (Figure 8, line 22). Decomposes a unit of a maximal 
order M into a product of generators of . See Section 3.1.5 for the related 
discussion. 

• Algorithms for conjugation of maximal orders by an element, multiplication 
of ideals and maximal orders, ideals inversion, conjugation of ideals by quater¬ 
nion are well known. (Figure 8, line 26) 

Now we discuss the details of the FIND-S-GENERATORS procedure. Its cor¬ 
rectness immediately follows from the discussion. The procedure builds levels (see 
Dehnition 3.29) of the spanning tree one by one. Level zero (line 9) contains only 
one vertex corresponding to M. We computed the description of M using CONJ- 
CLASS-DESCR. Level one (line 10) is constructed using the procedure S-NEIGHBORS 
(Figure 6), which is also a core subroutine for constructing all subsequent levels. We 
discuss it in more detail next. 

Given vertex description v (see Dehnition 3.29) and maximal orders adjacency 
structure (see Dehnition 3.12), the procedure S-NEIGHBORS constructs a list of ver¬ 
tex descriptions of S-neighbors of the maximal order M' corresponding to (s, q) =MAX- 
ORDER(n). More precisely, it gives a list of all pk neighbors of Ai' with k > IDEAL- 
ID (n). We get the description of all p*, neighbors of Ai' using the maximal order 
adjacency structure. Given a list Adj^^ = , {snjQn) of descriptions of 

pfc-neighbors of Aig, the list of its p^-neighbors is qiAig^q^^, ■ ■ ■ ,qNAis^q]^^- As 
Ai' = qAisq~^ we see that all p^-neighbors of Ai' are of the form qqjAisjqJ^q~^ and 
their description is {sj,qqj). This is precisely how we construct the sequence N on 
line 5 of the S-NEIGHBORS procedure. Level one of the spanning tree must include 
all S'-neighbors of Ai. This is precisely what happens because we have IDEAL- 
ID(Vo[l]) equal to one. Gurrently we have shown that our algorithms builds levels 
zero and one of the spanning tree correctly. 

Let us now discuss the procedure NEW-LEVEL that builds level k of the tree 
given levels k — 1 and k — 2. We will show that it correctly builds level fc, under the 
assumption that levels k — l,k — 2 were built correctly. To build a new level we iterate 
through all vertices v of level k — 1 that are not leaves (in other words, that are not 
of conjugacy type Sq). For each v and for each j > IDEAL-ID(n), we hnd the pj- 
neighbors of the maximal order represented by v. They are candidates for elements of 
level k. The extra constraint on j ensures that we will only get paths in the tree that 
correspond to factorizations with ordered norms of factors. By Proposition 3.23 we 
know that there are two alternatives for p^-neighbors of vertices in level k — 1: They 
are either in level A; — 2 or in level k. When j > IDEAL-ID(n), the only possibility is 
that the pj-neighbors are in level k. This follows from Proposition 3.28. This is why 
in this case we add the corresponding vertex description to Vnew on line 30 without 
extra checks. When j=IDEAL-ID(n), we need to verify that the order we are adding 
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Input: Maximal order of Q, set S' of prime ideals of Rp 
1: procedure FIND-S-GENERATORS(Af,S) 

2: M ^SPANNING-TREE-SIZE(M,S) 

3: if M = oo then 

4: return 0 

5: else 

6: Adj ^MAX-ORDERS-ADJ(Al,S) 

7: (so,go) ^ CONJ-GLASS-DESGR(Af) 

8: E <(— sequence of levels of Ts{A4) of size M, each level is empty 

9: Vo (1, 0, So, qo) > Sequence of length one 

10: El ^ S-NEIGHBORS(Adj,l,Eo[l]) > See Figure 6 

11: for all k = 2,..., M do 

12: Ec ^ NEW-LEVEL(Adj,so,EA,_i,Efc_ 2 ) 

13: end for 

14: return {q : (sq, q) = MAX-ORDER(n), n G Vk,k = 1,... ,M} 

15: end if 

16: end procedure 

Output: Set of canonical generators geng(Al) if Gs{JVl) hnite and 0 otherwise 


Input: Maximal orders adjacency description Adj, sq - conjugacy class of Al, 

vertices description of the current layer Vc, of the previous layer Vpr. 
procedure NEW-LEVEL (Adj,So,Ec,E)r.) 

Vnew ^ empty sequence of vertex descriptions 
for all m = 1,..., LENGTH(V) do 
(s',g') ^ MAX-ORDER(V[m]) 
if s' 7^ So then 


17 

18 

19 

20 
21 
22 

23 

24 

25 

26 

27 

28 

29 

30 

31 

32 

33 

34 

35 

36 


N ^S-NElGHBORS(Adj,m,V[m]) 

O ^ MAX-ORDER(Ep^[PARENT-lD(Ec[m])]) 

for all n' G V do 

if IDEAL-ID(n) = IDEAL-ID(E) then 
if 1S-EQUAL(0,MAX-0RDER(E)) then 
Append v' to Vnew 

end if 
else 

Append v' to Vnew 

end if 
end for 
end if 
end for 
return Vnew 
end procedure 


> See Figure 6 


> See Figure 6 


Figure 5. The algorithm for constructing spanning tree of Gs{M.). 
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Input: Maximal orders adjacency description Adj, 

index of the vertex description in its level m, 
vertex description v 

1: procedure S-NEIGHBORS(Adj,m,n) 

2: (s,g) ^ MAX-ORDER(n) 

3: N ^ empty sequence of vertex descriptions 

4: for all k = IDEAL-ID(n),..., TOTAL-IDEALS do > See Remark 3.30 

5: Append v G {(fc, m, s', gg') : {s',q') G Adj^^i,} to N 

6: end for 

7: return N 

8: end procedure 

Output: Vertex descriptions of S'-neighbours of v 

Input: Si, Qi defining a maximal order QiAisiQ^^ 

M-si is the maximal order with index Sj in the 
sequence output by CONJ-CLASSES-LIST > See Remark 3.30 
9: procedure IS-EQUAL((si, gi),(s 2 , g 2 )) 

10: if Si = S 2 then 

11: Afi,...,Mz ^ CONJ-CLASSES-LIST > See Remark 3.30 

12: Let gi,..., gm be generators of M.si 

13: g ^ gi“^g 2 

14: return TRUE if all qgkq~^ are from Aisi, FALSE otherwise 

15: else 

16: return FALSE 

17: end if 

18: end procedure 

Output: TRUE if maximal orders are equal and FALSE otherwise 

Figure 6. Subroutines used in the algorithm for building spanning 
tree of Gs{M.) and hnding its leaves. 

belongs to the level k. Because of the uniqueness of the factorization, the only order 
that is (a) a p^-neighbor of the order described by v and (b) belongs to level k — 2 
is the order A4" corresponding to PARENT-ID(n). In the procedure NEW-LEVEL, 
we add to Vnew precisely the orders not equal to Ad" on line 27. We have shown that 
NEW-LEVEL only adds orders to level k that belong to level k. It remains to show 
that it hnds all of them. Suppose the order Ad' should be on level fc; then there 
is a unique ordered factorization of the primitive ideal that contains Ad'Ad. This 
immediately implies that Ad' is a pj-neighbor of some order on level k — 1 and that 
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Input: Maximal order of Q, set S' of prime ideals of Rp 
1: procedure SPANNING-TREE-SIZE(M,S) 

2: Adji 1,..., Adj^ I ^ MAX-ORDERS-ADJ(S) 

3: (so,go) ^ CONJ-CLASS-DESCR(Al) 

4: El ^ {{so,j,i) : {j,q) G Adj.^^^A = 7 ^ So} 

5: fc 1 

6: while Ek is not empty do 

7: for all (s,jA) ^ do 

8: if #{(s,g) : {s,q) e Adjj-i,s A Sq} > 1 then 

9: Efc_|_i <— Ek+i U {(j, s, z)} 

10: end if 

11: Ek+i ^ Ek+i U {(j,s'A) : (s',g) e Adjjy,s' A so,s' A s} 

12: for all z' = z -|- 1,..., / do 

13: Ek+i ^ Ek+i U {(j, s', i') : (s', q) G Adj^y, s' A Sq} 

14: end for 

15: end for 

16: if Efc_|_i is equal to one of Ei,..., then 

17: return oo 

18: else 

19: k ^ k + l 

20: end if 

21: end while 

22: return k 

23: end procedure 

Output: Depth of the Ts{A4.) if its hnite and oo otherwise 

Figure 7. The algorithm for hnding depth of the spanning tree of Gs{M.) 

the IDEAL-ID of the corresponding vertex is less than j. This completes the proof 
of the correctness of NEW-LEVEL. 

Now we discuss the SPANNING-TREE-SIZE procedure that determines the num¬ 
ber of levels in the spanning tree. In the SPANNING-TREE-SIZE procedure, we 
compute a rough description of all edges of Ts(M). Now we describe what this 
means precisely. Note that by Proposition 3.23 every edge of Ts(M) connects maxi¬ 
mal orders of level k — 1 and k. Let M' be the maximal order of level k — 1 and M" 
be the maximal order of the level k. With each edge, we associate a tuple {s,j,i) 
that we call an edge description. Integers s and j denote the conjugacy class of Ai' 
and A4". Integer z in the description means that Ai' and A4" are pj-neighbors. The 
sets Efc that we build in the algorithm are sets of all edge descriptions corresponding 
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Input: Maximal order of Q, set S' of prime ideals of -Ri;’, 

an element q oi A4. snch that NTd{q)RF factors into ideals from S 
(assnmes that two side ideal class gronp of Q is trivial) 

1 ; procedure EXACT-SYNTHESIS-l(Al,R,g) 

2: gen 5 (Al) <(—FIND-S-GENERATORS(AI,S') » Precomputed, Figure 5 

3: G ■(— {PRIMITIVE-REPR(AI, x) : x G gen 5 (Al)} > Precomputed 

4: Let S'o = {pi,..., pi} be all elements of S 

that does not divide the discriminant of Q 
5: q^ PRIMITIVE-REPR(Af, q) 

6: G empty sequence of quaternions 

7: while n 5 Q(Nrd(g)) > 0 do 

8: Find gmin from G such that q^l^q is in A1 

and usp (Nrd(g“j'^g)) minimal possible 
9: Add gmin to the end of G, g ■(— q^l^q 

10: end while 

11: Add TWO-SIDED-DECOMPOSE(g,Al,R) to the end of G 

12: return G 

13: end procedure 

Output: Outputs qi,... ,qm,Ui,... ,Un,<y such that there product is q, 
where g* are from geng(Al) U ext|(Al) 
and Uj are generators of the unit group of At 

14: procedure TWO-SIDED-DECOMPOSE(g,Af,R) 

(assumes that two side ideal class group of Q is trivial) 

15: Qi,, Qm - generators of prime ideals with the norm 

that divides discriminant of Q and from S 
16: G empty sequence of quaternions 

17: Find a from F such that aq is integral and 

Nrd(ag) does not divide the discriminant of Q, g <(— aq 
18: while n 5 (Nrd(g)) > 0 do 

19: Find gmin from Qi,..., Qm such that g~i^ng is in At 

20: Add gmin to the end of G, g g^j^g 

21: end while 

22: Add UNIT-DECOMPOSE(g) to the end of G > See Section 3.1.5 

23: return G, a 

24: end procedure 


Input: Maximal order At of Q, an element g of At 

(assumes that two side ideal class group of Q is trivial) 


25: 

procedure PRIMITIVE-REPR(At,g) 


26: 

/ (gAtg“^)At 


27: 

Ipr ^ PRIMITIVE-IDEAL (J) 

> See Figure 1 

28: 

return IDEAL-GENERATOR(/) 

> See Remark 3.30 

29: 

end procedure 



Figure 8. Exact synthesis algorithm for hnding decomposition de¬ 
scribed in Theorem 3.18 and related subroutines. 
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to the edges connecting levels k — 1 and k, excluding edges that are connected to 
leaves on level k. The core observation is that we can build -Efc+i from only 
using the maximal orders adjacency structure Adj. The spanning tree Ts{A4) has 
depth N if and only if is empty but E^-i is not. Also note that the number of 
different edge descriptions is hnite (and completely described by Adj), so therefore 
the number of possible sets E). is also hnite. This implies that Ts{A4.) has inhnite 
depth if and only if there exist k and n such that E^ = Ej.. 

Now we discuss how to build Ei and how to build from E^. Elements of 
El have the form where j goes through the labels of all conjugacy classes 

not equal to sq of pj-neighbors of AT, sq is a conjugacy class of Ai and there is no 
restriction on i. This is precisely how we build Ei in SPANNING-TREE-SIZE on 
line 4. Let us now look how to build Ek+i given Ek. We iterate through all edge 
descriptions E^. Each edge description {s,j,i) corresponds to all possible pairs of 
orders (A4',A4") such that: 

• Ai' belongs to level A; — 1 of Ts(A4), conjugate to AT^ 

• AT" belongs to level k of Ts(Ai), conjugate to Aij 

• AT' and AT" are pj-neighbors 

There are two sets of maximal orders that are in level k + 1 and are S'-neighbors 
of AT". One set consists of the pj-neighbors of AT' and the other set contains the 
pj/-neighbors of AT" for i' > i. Note that number of p-neighbors of AT" and their 
conjugacy classes depend only on j and the same for all AT". For the second group 
we add edge descriptions (j, s', i') where s' ^ Sq goes through all conjugacy classes of 
all pj/ neighbors of AT" (this is done on line 13). For the hrst set we need to take into 
account that AT" has one pj-neighbor in level k — 1 that is precisely AT'. Therefore 
we need to add the edge description (j, s, i) only in the case when AT" has more than 
one pj-neighbor that is conjugate to AT^. This this precisely what is done on line 9. 
We also need to add the edge descriptions corresponding to all pj-neighbors of AT" 
that are not conjugates of AT^. This is what is done on line 11. 

The proof of correctness of SPANNING-TREE-SIZE uses the same ideas as the 
proof of correctness of NEW-LEVEL and we do not provide it here. It is also inter¬ 
esting to note that one can count the number of leaves of Ts(A4) without building 
it using a slightly modihed version of SPANNING-TREE-SIZE that has edge multi¬ 
plicities in its edge description structure. 

3.2.4. Canonical form of the factorization. Now we will briefly discuss why the fac¬ 
torization of elements of AT 5 considered in Theorem 3.20 corresponds to a canonical 
form. Gonsider q from AT 5 . According to Theorem 3.20, we can write q = qi... qnQo, 
where qi,... ,qn G geng(AT) and where go generates a two-sided ideal of AT. Let us 
now assign a label to each qk from gen 5 (AT). Let A be the primitive ideal containing 
qkAi. Let Ik,i ■ ■ ■ Ik,n{k) be a factorization of A into primitive maximal ideals. The 
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label of Qh will consist of left and right parts. The left will be the label of the maximal 
ideal and the right part will be the label of the maximal ideal Ik,n{k)- The label 
of a maximal ideal consists of two parts. The hrst part is the index of its norm p 
in the list pi,..., p; of elements of S that do not divide the discriminant of Q. The 
second is the point of the projective line P^(i?ir/p) corresponding to the ideal by 
Lemma 3.9. Let us order the factorization of the primitive ideal that contains qA4 
according to Proposition 3.27 and build the factorization qi... qnqo out of h- Let 
((4, {xk,yk)), Uk, {zk,Wk))) be a label of It is not difficult to see that jk < 4+i- 
In the case when jk = 4+i, h must be the case that (x^, yk) 7 ^ {zk, Wk)- On the other 
hand, if we obtained two different factorizations in terms of gen_g(A^) satisfying the 
above-mentioned condition on labels, then they must correspond to two different ele¬ 
ments of Ais- This follows from the uniqueness of the ordered factorization. Finally, 
for any factorization in terms of gen 5 (A^) that satishes the label constraints, it is 
true that fisiQi ■ ■ -(InQo) = Later we will see that these generic ideas 

explain some of the canonical forms of quantum circuits that can be found in the 
literature. 


4. Applications 

The goal of this section is to explain how to use tools described in the previous 
section to study the following questions about two by two unitaries: 

• Given some hnite set G of unitaries, hnd a special form of unitaries containing 
the group they generate. 

• Are all unitaries of this special form representable by elements from the set 
G? If so, how can we hnd such a representation. If not, 

— How to hnd the counterexample? 

— Can one hnd a bigger set G' of unitaries that generates all matrices of 
the mentioned special form? 

• What is a good general approach to specifying this special form of the uni¬ 
taries? 

• Is there some canonical set G" of unitaries such that any unitary of the 
mentioned special form can be uniquely written using elements of G"? Is 
there a canonical form for unitaries with this special form? 

These questions are usually studied under the name of exact synthesis of unitaries. 
Our goal is to provide guidance for choosing a number held F, a quaternion algebra 
Q, a maximal order A4 in the quaternion algebra and the set S of ideals of Rp 
to study some interesting instances of exact synthesis problems. Roughly speaking, 
all these choices depend on the number held over which the unitary matrices are 
represented. It is also much simpler to map special unitaries to quaternions than to 
map general unitaries to quaternions. However, the simple way of turning a general 
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unitary U into a special unitary U /\/det U is not applicable in our case, as taking 
square roots generally makes number fields more complicated. In this section, we 
first discuss an alternative, unnormalized realization of unitaries by quaternions that 
enables the use of simpler number fields. Then, we discuss how to make the choices 
mentioned above by working with the unnormalized realization of unitaries from the 
gate set we study or related to the special form of the unitaries we study. 


4.1. Choosing a quaternion algebra using the unnormalized realization of 
unitaries. Let iL be a CM field (i.e. a totally imaginary extension of a totally real 
number field) with real subfield F = iL fl M. Consider the following form of unitary 
matrices: 

TT 1 / T zVb \ ^ 

w ^ ^ 

Most unitaries considered in the applications have the form described above. We can 
rewrite as a product U 1 U 2 of two unitaries, where 


U,= 



X 

yVb 


-■y ),»= 


1 0 
0 a 



det U 
det Ui 


e K. 


Now we will show that we can represent U using the set of matrices 


We chose 6 to be a part of the definitions of the set of unitaries because in most 
applications y/b is usually fixed for the gate set that one studies. We say that the 
matrix M from M[K, h] represents U if the following holds for all density matrices 


P- 


UpU^ 


MpM^ 

det M 


Note that if Mi represents Ui and M 2 represents U 2 then Mi M 2 represents UiU 2 - It is 
not difficult to see that when a ^ —1, the above unitaries Ui and U 2 are represented 
by 


Ml = 


X —y*Vh 

y\/b X* 


,M 2 


1 + a* 0 \ 

0 1 + a j' 


Note that by using this realization, we got rid of \fd and the matrices we consider 
are special unitaries up to a scalar. Another useful property of the unnormalized 
representation is that M and f3M for P E F represent the same unitary matrix. 

Now we show how to choose a quaternion algebra corresponding to M[K, b]. Note 
that K can always be represented as F{\/—D), where F is a totally positive element 
of F. Any element of K can be written as Xi + X 2 \/—D for xi^X 2 from F. Using 
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y/—D, an unnormalized realization of the Pauli matrix Z (the case a = —1 excluded 
above) can be written as 

0 


0 




xi,x2,yi,y2 e F. 


An arbitrary matrix M from M[iP, h] can be written as 
/ Xl + ^/^X2 -{yi-\f^y2)\/h\ 

V {yi + \f^y2) Vb Xi- y/^X2 ) ’ 

Using Pauli matrices I, X, Y, Z, we can write a matrix from M[K, b] as 
(9) Xil + X2V—DZ — yi^/^Y + y2\/ —DbX. 


We now map elements of M[K,b] to the quaternion algebra Q = Let 

i,j,k be elements of Q such that P = = —b and k = ij. Define an F-linear 

map K : M[F, 6 ] —)■ Q via 

K(^^/^Z^=i, k(^-^/^Y^=}, niy^DbX^ =k. 

The quaternion k{M) corresponding to the matrix M in (9) is x\ + X 2 i + yi} + i/ 2 k. 
The map k has several useful properties. The determinant of M is equal to the norm 
of k{M). The trace of M is equal to the reduced trace of a(M). The conjugate 
xi — X 21 — 2/ij — i/ 2 k of the quaternion k{M) is equal to k(m1). 

We have shown how to establish the correspondence between unitaries and quater¬ 
nions using an unnormalized realization. It is useful to note that the inverse of a 
unitary U is represented by a conjugate of the quaternion corresponding to U. Ta¬ 
ble 1 shows the quaternion algebras and number fields corresponding to some well 
known gate sets. Some of our examples are related to cyclotomic number fields 
Q(Cn) where (n is ii-th root of unity. The real subheld in this case is Q(Cn + CT^) 
when n 7^ 4 and Q otherwise. Let Dn be such that Q(Cn) = F [^/—Dn\ for F being 
the real subheld. When 4|?7, we can choose Dn = 1, in all other cases we choose 
Dn = 4-{Cn + Cn^. 


4.2. Choosing the maximal order and set of ideals S. To apply the framework 
we developed it is crucial to represent unitaries using integral quaternions. A simple 
way to ensure that the quaternion xi + X 2 i + Xaj -|- X 4 k is integral is to rescale it 
by an element /3 G F such that I3xk G Rp- This will ensure that all quaternions 
corresponding to the gate set of interest belong to the order 

Lq = Rp Y Rpi Y Rpi Y Rpk 

Next we compute a maximal order that contains Lq using known algorithms. For 
some classes of quaternion algebras there are known explicit constructions of maximal 
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Gate set 

Matrices 

example 

Projective 

representation 

K 

b 

F 

D 

Clifford+T 

T = 

H = 

*( ] 1) 

{ i+a 0 \ 

V 0 i+cs; 

(: 1) 

QlCs) 

1 

Q(C8+C8"^) 

1 

ClifFord- 

cyclotomic[12] 

Tr, = 

d; :) 

f i + a 0 \ 

V 0 l + Cn J 

<Q(Cn) 

1 

Q(Cn + Cn 

Dn 

V-basis[3, 28, 27] 

^(/ + 2iZ) 

^(/ + 2iA) 

I + 2iZ 

I + 2iX 

QW 

1 

Q 

1 

Fibonacci[22] 

( 

( 

( 

1 0 \ 

0 Cio ) 
b —\/b A 

v/6 b J 

1 “) 

M + Cfo 0 \ 

V 0 1 + cio y 

/ b —Vb X 
\ Vb b ) 

f ^/5T^2 0 X 

V 0 -^/EF^2 J 

<Q(Cio) 

n/5-1 

2 

^(Cio + Cw ) 

2-b 

su{2)J16] 

1 - 

mw 

f q -Vb X 
\Vbq*) 

1 0 \ 

0 -1 J 

Q = Ck + 2, 

ol/2 o-l/2 

( i-V 0 X 

VO l-q J 

/ q -Vb A 

V g* j 

( v^ 0 x 

V 0 -^/=D ) 

Q(<?) 

isj? 

Q(<? + 9“b 

Dk+2 

{B,K,Z} [26] 

ZIT 

1 0 \ 

0 -1+4^ ) 

31 - 2V^Z 

<Q(C6) 

-1 

<Q 

-3 


Table 1. Examples of choosing quaternion algebra for different gate sets 


orders containing Lq (see e.g. Proposition 8.7.3 [29]). Next we discuss a simple 
generalization of one of examples from [29]. 

We describe an explicit example of a maximal order in the quaternion algebra 
Suppose Rf contains an element ^ such that is equal to 2 up to a unit 
oi Rp. Consider the following order: 

(10) + 1) + —i?_F(j + 1) + -^Rp{l + i + j + k) 

By direct computation we can check that the discriminant of the order above is equal 
to This implies that the order is maximal and the corresponding quaternion 
algebra has discriminant Rp- One example of F that satisfy the required property 
is Q(C8n + Csrt) which is directly related to some of the Clifford-cyclotomic gate sets. 

Let us now discuss how to pick the set S of prime ideals of Rp . We assume that we 
started with some set of gates and now have a set Gq of quaternions in a quaternion 
algebra Q. The set Gq is also a subset of a maximal order M. we constructed earlier 
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Gate Set 

F 

M 

S 

Clifford+T 

Q(\/2) 

Z[x/2] + Z[x/2] 1+' + Z[^/2] + Z[x/2] 

{P2} 

V-basis 

Q 

Z + Zi + Zj + Z^+‘+j+^ 

{5Z} 

Clifford+T+V 

Q(\/2) 

Z[^/2] -F Z[x/2]^ -t- Z[x/2]^ -f Z[x/2]i±I±j±I^ 

{p2, 5Ri7’} 

Fibonacci 

Q(</2), 

Z[99]+Z[(^]i±I+Z[v?]j + Z[(^]j^ 

{P5} 

{B,K,Z} [26] 

Q 

Z + Zl^ + Zj + Z'BA 

{3Z, 7Z} 


Table 2. Examples of maximal ideals and sets of prime ideals for 
different gate sets. Here, p 2 = (2 + \/2)Z[\/2] = \1 + satisfies 

p 2 = 2Z[\/2], (p = generates the ring Z[(p] of integers of Q(\/5), 
and where ps = satishes p| = 5Z[93]. 


in this section. Given g G Go, then qM. is a right ideal of Ai. We can write it as 
(11) qM = IP,---Pk-{aM), 

where / is a primitive ideal, the Pj are prime ideals of Ai whose norms divide 
the discriminant of Q and a is an ideal of Rp- If two qnaternions have the same 
factorization (11) up to an ideal a they correspond to the same unitary and therefore 
a is irrelevant for our purposes. We then take S to be the set of prime ideals of Rp 
that divide the norm of I or that divide the norm of some Pj. In Table 2 we provide 
examples of S for several gate sets of interest. 

4.3. Remarks on previously-studied gate sets. The questions related to the ex¬ 
act synthesis and canonical forms of Clifford-|-T gate set were widely studied before 
[13, 25, 14, 30, 6]. Here we briefly summarize the result of applying the framework 
developed in this paper (see also Tables 1,2). The quaternion algebra correspond¬ 
ing to Chfford-|-T is totally dehnite. The unit group of the maximal order (10) is 
hnite and equal to the binary octahedral group, which is otherwise known as the 
single qubit Clifford group. Interestingly, there is an Euclidean algorithm for this 
quaternion algebra [8]. This implies that in the Clifford-I-T case any primitive ideal 
is principal. Using the generic approach to constructing canonical forms described in 
the end of Section 3.2, we precisely obtain the canonical form described in Ref. [14]. 
Our framework also leads to a very similar exact synthesis algorithm. Finally, it 
leads to the same description of exactly synthesizable unitaries. The Clifford-|-T 
gate set can be extended by adding single qubit unitaries that can be implemented 
using RUS circuits [31, 5, 4]. Our framework can also be applied to such extended 
gate sets by adding extra prime ideals to the set S. 
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The approach taken in [22] to the exact synthesis of braids for Fibonacci anyons is 
quite different from the Clifford+T and Clifford-cyclotomic gate sets. This difference 
is explained by our framework: the relevant quaternion algebra is indehnite and 
therefore has an inhnite unit group. Luckily, in this case the quaternion algebra 
is dehned over the totally real held Q(\/5) and splits at exactly one real place. 
Therefore, the methods developed in Ref. [36] apply directly. In this case the set 
S contains the unique ideal whose norm divides the discriminant of the quaternion 
algebra. This means that all exact synthesis questions in this case are related to 
two-sided ideals and the unit group of the maximal order. 

Finally, our methods provide an alternative proof of Theorem 5.1 in [12], which 
characterizes the gates that can be exactly synthesized from some Clifford-cyclotomic 
gate sets. They also provide an algorithmic solution to the question: What unitaries 
must one add to the Clifford-cyclotomic gate set to be able to synthesize all unitaries 
over the ring Z[i,C„]? In the general case, computing the gate set based on the 
quaternion algebra (^), the maximal order Ai and a set S of prime ideals oi Rp 
is at least as hard as computing the unit group Rp [19]. The problem of computing 
the unit group of an arbitrary degree number held is known to be hard for classical 
computers and solvable on quantum computers [11]. For small n the question can 
be answered using computational number theory packages, like MAGMA. For large 
n, the question quickly becomes computationally intractable. 


5. Summary and open questions 

The developed framework allows us to state the question of approximating oper¬ 
ators by exactly synthesizable unitaries in a simple way. Consider unitaries 

corresponding to a quaternion algebra (^), a set of prime ideals S oi Rp and a 
maximal order A4. containing Rp + Rpi + Rp] -|- Rp\^. The unitaries can be written 
in the form 


U 


/ „ 9^9 , + '/^ZX2 - VbYX3 + 

\/xj — ax 2 — OTg -|- aox^ ^ 



, Xj G Rp, 


where the ideal a = (xf — ax^ — bxl + ahx\)Rp must factor into ideals from S. For 
example, in the case when F is a totally real number held and (^) is a totally 
dehnite quaternion algebra, the integer Xlpes '^p(^) used to bound the number 

of gates required to implement U. This is precisely what is needed for the number- 
theoretic approximation algorithm: a simple description of the exactly synthesizable 
unitaries that require a bounded number of gates to be implemented. Developing 
the details of such an approximation algorithm for dehnite and indehnite quaternion 
algebras will be addressed elsewhere [1]. As soon as an exact unitary is output by 
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an approximation algorithm, one of the exact synthesis algorithms described in this 
paper can be used to obtain the circuit implementing it. 

There is an interesting open question related to the situation when we do not have 
all the generators described by quaternion algebra (^), the maximal order A4 and 
the set S. We will illustrate it on a simple example of the Id-basis (see Table 2). 
Consider the gate set G* consisting only of Vq = :^(-f + 2iX) and Vi = :^(-f + 2iZ) 
together with their inverses. For a binary string b(l),..., b(n), the unitary Ui, = 
14(1) • • • 14(n) can be easily decoded using an exact synthesis algorithm. The gate 
set G* is universal and moreover, it is efficiently universal (i.e. can approximate an 
arbitrary unitary within precision £ using a circuit of length 0(log(l/e))) by results 
contained in [15, 7]. The same is true for the complete Id-basis. However, length-n 
circuits over the full Id-basis produce a much denser covering of unitaries than is 
possible with length-n circuits over G*. Let us now choose Eq such that the closed 
ball B[Ub,£o] of radius Eq and with center in Ub contains only one element of (G*) 
but elements representable by circuit of length n over Id-basis. Let us now 

pick a random unitary U' inside B[Ub,Eo]. Is there a polynomial-time algorithm for 
recovering b from UG It is not difficult to generalize the question to more general 
gate sets that can be obtained by our framework. 
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